CVE-2026-6469: PostgreSQL ALTER TABLE ALTER TYPE resets extended statistics ownership
Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS via this improper ownership. It wrongly denies those commands to the prior statistics object owner. DROP TABLE remains able to remove statistics objects, so this exploit achieves nothing in many ownership arrangements. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.11 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.19 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.24
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6469?
The severity of CVE-2026-6469 is rated as low with a score of 3.8.
How do I fix CVE-2026-6469?
To fix CVE-2026-6469, ensure that you manage ownership of statistics objects carefully after using ALTER TABLE ALTER TYPE.
What type of vulnerability is CVE-2026-6469?
CVE-2026-6469 is a vulnerability that involves incorrect ownership assignment in PostgreSQL.
What is affected by CVE-2026-6469?
CVE-2026-6469 affects PostgreSQL's ALTER TABLE ALTER TYPE command and the ownership of dependent statistics objects.
What can attackers do with CVE-2026-6469?
With CVE-2026-6469, an attacker could exploit the incorrect ownership to run DROP STATISTICS and ALTER STATISTICS commands.